> For the complete documentation index, see [llms.txt](https://nightowl131.gitbook.io/aapg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nightowl131.gitbook.io/aapg/manual-static-analysis/source-code-analysis.md).

# 1.4 Source Code Analysis

## 1.4.1 SEARCH

### Endpoints & URL-matching patterns

```
grep -Ei 'api' -Ei 'http' -Ei 'https' -Ei 'URI' -Ei 'URL' -R .
```

```
grep -Eio '(http|https)://[^/"]+' -Eio 'content://[^/"]+' -R .
```

### Files & their permissions

```
grep -Ei 'MODE_WORLD_READABLE' -Ei 'MODE_WORLD_WRITEABLE' -R .
```

```
grep -Ei 'getCacheDir' -Ei 'getExternalCacheDirs' -R .
```

```
grep -Ei 'openFileOutput' -Ei 'FileOutputStream' -Ei 'OutputStream' -Ei 'getExternalFilesDir' -R .
```

### Database & realms

```
grep -Ei 'localUserSecretStore' -Ei 'getWriteableDatabase' -Ei 'getReadableDatabase' -R .
```

```
grep -Ei 'realm' -Ei 'getDefaultInstance' -Ei 'beginTransaction' -Ei -R .
```

```
grep -Ei 'SQLiteDatabase' -Ei 'insert' -Ei 'query' -Ei 'delete' -Ei 'update' -R .
```

### User

```
grep -Ei 'username' -Ei 'user' -Ei 'pass' -Ei 'passwd' -Ei 'userid' -Ei 'password' -R .
```

```
grep -Ei '.config' -Ei 'secret' -Ei 'token' -Ei 'login' -Ei 'auth' -R .
```

### Logs

```
grep -Ei 'Log.v' -Ei 'Log.d' -Ei 'Log.i' -Ei 'Log.w' -Ei 'Log.e' -R .
```

```
grep -Ei 'log' -Ei 'logger' -Ei 'printStackTrace' -Ei 'System.out.print' -Ei 'System.err.print' -R .
```

### Content

```
grep -Ei 'Cursor' -Ei 'content' -Ei 'ContentResolver' -Ei 'CONTENT_URI' -Ei 'Loader' -Ei 'onCreateLoader' -Ei 'LoaderManager' -Ei -R . 
```

### Keystore

```
grep -Ei 'AndroidKeystore' -Ei 'KeyStore' -Ei 'crypto' -Ei 'cipher' -Ei 'store' -R .
```

## 1.4.2 OPEN SOURCE FILES

```
jd-gui app-dex2jar.jar
```

{% hint style="info" %}

* opens **.jar**/.**java**/.**class** files
* or use an IDE of your choice (android studio or eclipse)
  {% endhint %}

## 1.4.3 INFO

INTERESTING CLASSES

{% hint style="info" %}

* **SharedPreferences** (stores key-value pairs)
* **FileOutPutStream** (uses internal or external storage)
  {% endhint %}

INTERESTING FUNCTIONS

{% hint style="info" %}

* **getExternal**\* (uses external storage)
* **getWriteableDatabase** (returns SQLiteDB for writing)
* **getReadableDatabase** (returns SQLiteDB for reading)
* **getCacheDir** / **getExternalCacheDirs** (uses cached files)
  {% endhint %}

## 1.4.4 THINGS TO REPORT

{% hint style="danger" %}

* Cleartext credentials \
  (includes base64 encoded or weak encrypted ones)
* Credentials cracked \
  (brute-force, guessing, decrypted with stored cryptographic-key, a.s.o...)
* File permission **MODE\_WORLD\_READABLE** / **MODE\_WORLD\_WRITEABLE** \
  (other apps/users are able to read/write)
* If *http* is in use (**no SSL**)
* Anything that shouldn't be there \
  (debug info, comments with info disclosure, ...)
  {% endhint %}